diff --git a/build/scripts/standalone/entrypoint.sh b/build/scripts/standalone/entrypoint.sh
index 1282429356..744c935469 100644
--- a/build/scripts/standalone/entrypoint.sh
+++ b/build/scripts/standalone/entrypoint.sh
@@ -16,6 +16,7 @@ EXAMPLE_LOCAL="${EXAMPLE_CONF_DIR}/local.json"
 NGINX_CONFIG_PATH="/etc/nginx/nginx.conf"
 NGINX_DS_DIR="${EO_CONF}/nginx"
 NGINX_DS_CONF="${NGINX_DS_DIR}/ds.conf"
+NGINX_DS_COMMON_CONF="${NGINX_DS_DIR}/includes/ds-common.conf"
 NGINX_DS_SSL_TMPL="${NGINX_DS_DIR}/ds-ssl.conf.tmpl"
 SUPERVISOR_CONF_DIR="/etc/supervisor/conf.d"
 
@@ -46,8 +47,13 @@ METRICS_PORT="${METRICS_PORT:-8125}"
 METRICS_PREFIX="${METRICS_PREFIX:-ds.}"
 GENERATE_FONTS="${GENERATE_FONTS:-true}"
 
+MAX_FILE_SIZE="${MAX_FILE_SIZE:-104857600}"
+MAX_ZIP_UNCOMPRESSED_DOC="${MAX_ZIP_UNCOMPRESSED_DOC:-50MB}"
+MAX_ZIP_UNCOMPRESSED_XLSX="${MAX_ZIP_UNCOMPRESSED_XLSX:-300MB}"
+
 NGINX_WORKER_PROCESSES="${NGINX_WORKER_PROCESSES:-1}"
 NGINX_ACCESS_LOG="${NGINX_ACCESS_LOG:-false}"
+NGINX_CLIENT_MAX_BODY_SIZE="${NGINX_CLIENT_MAX_BODY_SIZE:-100m}"
 SSL_VERIFY_CLIENT="${SSL_VERIFY_CLIENT:-off}"
 ONLYOFFICE_HTTPS_HSTS_ENABLED="${ONLYOFFICE_HTTPS_HSTS_ENABLED:-true}"
 ONLYOFFICE_HTTPS_HSTS_MAXAGE="${ONLYOFFICE_HTTPS_HSTS_MAXAGE:-31536000}"
@@ -234,6 +240,20 @@ fi
 [ "$ALLOW_META_IP_ADDRESS" = "true" ] && \
   jq_set '.services.CoAuthoring["request-filtering-agent"].allowMetaIPAddress = true'
 
+# Upload / conversion size limits
+# limits_tempfile_upload and maxDownloadBytes are simple scalars — override via local.json
+jq_set '.services.CoAuthoring.server.limits_tempfile_upload = ($maxFileSize | tonumber? // $maxFileSize)'
+jq_set '.FileConverter.converter.maxDownloadBytes           = ($maxFileSize | tonumber? // $maxFileSize)'
+# inputLimits is an array that only exists in default.json; node-config would replace the
+# whole array if we put it in local.json (losing the 'template' fields), so patch default.json
+# directly with sed — the same approach the original manual recipe used.
+DEFAULT_JSON="${EO_CONF}/default.json"
+if [ -f "$DEFAULT_JSON" ]; then
+  # Replace all three 50MB entries (docx/pptx/vsdx) and the 300MB xlsx entry
+  sed -i "s/\"uncompressed\": \"300MB\"/\"uncompressed\": \"${MAX_ZIP_UNCOMPRESSED_XLSX}\"/g" "$DEFAULT_JSON"
+  sed -i "s/\"uncompressed\": \"50MB\"/\"uncompressed\": \"${MAX_ZIP_UNCOMPRESSED_DOC}\"/g"   "$DEFAULT_JSON"
+fi
+
 # Metrics (statsd)
 if [ "$METRICS_ENABLED" = "true" ]; then
   jq_set '.statsd.useMetrics = true'
@@ -282,6 +302,7 @@ jq \
   --arg metricsHost      "$METRICS_HOST" \
   --arg metricsPort      "$METRICS_PORT" \
   --arg metricsPrefix    "$METRICS_PREFIX" \
+  --arg maxFileSize      "$MAX_FILE_SIZE" \
   "$jq_filter" \
   "$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
 mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
@@ -312,6 +333,10 @@ if [ -f "$NGINX_CONFIG_PATH" ]; then
   fi
 fi
 
+if [ -f "$NGINX_DS_COMMON_CONF" ]; then
+  sed -i "s/client_max_body_size[[:space:]]\+[^;]\+;/client_max_body_size ${NGINX_CLIENT_MAX_BODY_SIZE};/" "$NGINX_DS_COMMON_CONF"
+fi
+
 if [ -n "${SSL_CERTIFICATE_PATH:-}" ] && [ -n "${SSL_KEY_PATH:-}" ] \
    && [ -f "$SSL_CERTIFICATE_PATH" ] && [ -f "$SSL_KEY_PATH" ] \
    && [ -f "$NGINX_DS_SSL_TMPL" ]; then
@@ -359,12 +384,14 @@ enable_supervisor_program() {
 # --------------------------------------------------------------------
 if [ "${EXAMPLE_ENABLED:-false}" = "true" ] && [ -d "$EXAMPLE_CONF_DIR" ]; then
   jq -n \
-    --arg secret "$JWT_SECRET" \
-    --arg header "$JWT_HEADER" \
+    --arg secret      "$JWT_SECRET" \
+    --arg header      "$JWT_HEADER" \
+    --arg maxFileSize "$MAX_FILE_SIZE" \
     '{
       "server": {
         "siteUrl": "/",
         "exampleUrl": "http://localhost/example/",
+        "maxFileSize": ($maxFileSize | tonumber? // $maxFileSize),
         "token": {
           "enable": true,
           "secret": $secret,
@@ -427,6 +454,44 @@ fi
 [ "$REDIS_SERVER_HOST"  = "localhost" ] && service redis-server start
 service nginx start
 
+# --------------------------------------------------------------------
+# Apply Postgres schema on first boot (idempotent).
+#
+# The stock image has no init step for this, so a fresh DB volume leaves
+# docservice failing with `DB table "task_result" does not exist` and
+# never binding to :8000 — nginx then serves 502 on /healthcheck.
+# --------------------------------------------------------------------
+ensure_db_schema() {
+  schema_file="${EO_ROOT}/server/schema/postgresql/createdb.sql"
+  [ -f "$schema_file" ] || return 0
+
+  db_psql() {
+    PGPASSWORD="${DB_PWD:-}" psql \
+      -v ON_ERROR_STOP=1 \
+      -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" "$@"
+  }
+
+  tries=0
+  until db_psql -tAc 'SELECT 1' >/dev/null 2>&1; do
+    tries=$((tries + 1))
+    if [ "$tries" -gt 60 ]; then
+      echo "ERROR: Postgres not reachable at ${DB_HOST}:${DB_PORT} after 60s" >&2
+      return 1
+    fi
+    sleep 1
+  done
+
+  # Probe a table that createdb.sql creates. Skip if already populated.
+  if db_psql -tAc "SELECT to_regclass('public.task_result')::text" 2>/dev/null \
+       | grep -qx 'task_result'; then
+    return 0
+  fi
+
+  echo "Applying Postgres schema from ${schema_file}..."
+  db_psql -f "$schema_file"
+}
+ensure_db_schema
+
 # --------------------------------------------------------------------
 # Fonts + plugins (background where appropriate).
 # --------------------------------------------------------------------